fix(openclaw): launch-fix — rebuild agent-shield on @palveron/sdk + tiered fail policy

[disruptivetrends]

Fixes the launch blockers proven in ANALYSE_AGENT_SHIELD_LAUNCH_READINESS.md. Read-only analysis → this build.

Root cause (B1)

agent-shield hand-built the /verify body, drifting from the gateway contract (gateway requires top-level prompt, reads tool_name from context, agent_id from metadata). Every verify failed server-side and the blanket fail-open swallowed it into a silent ALLOW — the agent ran ungoverned. Fix: one contract, one source — delegate verify/health/listPolicies to @palveron/sdk (also brings retries + circuit breaker). Verified the SDK's real wire format against sdk-typescript@1.1.0 before building on it.

What changed

Block	Fix
B1	src/client.mjs is a thin facade over @palveron/sdk; new contract test asserts the on-the-wire body (prompt top-level, context.tool_name, metadata.agent_id) through the real SDK
B2	init preflight uses sdk.health() → real GET /health (was /api/v1/health, which 404s in prod and killed init at step 1)
B3	new src/fail-policy.mjs: fail-LOUD on contract/auth (never ALLOW); transport tiered by risk (HIGH → fail-closed BLOCK, MEDIUM/LOW → fail-open ALLOW); AGENT_SHIELD_FAIL_CLOSED override; MCP catch returns ERROR, never silent ALLOW
B4	README/SKILL: honest advisory wording; hard in-path before_tool_call hook called out as roadmap
B5	correct MCP invocation everywhere: npx -y -p @palveron/agent-shield agent-shield-mcp
B6	removed dead BYOM LLM-key forwarding; BYOM is dashboard/server-side
B7	publishConfig.access: "public"
B8	added MIT LICENSE; README license aligned to MIT
B10	init reports the real activated+created count (no hardcoded "8")

Also: dropped the now-redundant client circuit-breaker (SDK owns resilience), removed agent-shield.zip, added .gitignore + CI (node 18/20/22).

Tests

node --test → 13 passing (contract + tiered fail policy, incl. "validation/auth → throws, never ALLOW" and "HIGH-risk outage → BLOCK").

⚠️ Decisions for @arndt (NOT decided here — please confirm)

• E1 — Version: stays 0.1.0 (honest pre-release while enforcement is advisory). Go 1.0.0 only after the in-path hook + verified live E2E. No code change; confirm?
• E3 — Default fail behavior: HIGH-risk now fails closed during a Palveron outage — a deliberate behavior change vs. the old "always fail open" README. Steerable via AGENT_SHIELD_FAIL_CLOSED. Confirm this is the intended default?
• E4 — Two MCP products: added a "Which package do I need?" section (agent-shield = OpenClaw/zero-config; @palveron/mcp-server = Cursor/Claude-Code). No consolidation now. OK?

Note on base

Supersedes the local-only WIP commit cfbde5a ("honor body.decision on 4xx") — the SDK handles that contract natively, so this PR is based on origin/master (3d8ab9e).

Live E2E (you run it — needs a TEST key)

Acceptance #2/#3 require a live smoke against gateway.palveron.com with a pv_test_ project key (never the prod core key). Script committed at scripts/smoke-live.mjs (refuses any key not starting with pv_test_):

# PowerShell
$env:PALVERON_API_KEY="pv_test_xxx"
node scripts/smoke-live.mjs

It checks: health, benign→ALLOW, rm -rf /→BLOCK, fake AKIA…→BLOCK (soft), outage HIGH→fail-closed / MEDIUM→fail-open, invalid key→fail-loud throw, and init (real count + idempotency + status). Please paste the output here.

🤖 Generated with Claude Code

[disruptivetrends]

Update — B10 resolved (the seeding caveat above is now fixed, not just flagged).

Investigating the "8 rules" seeding statically turned up something worse than a count gap: POST /api/v1/setup/openclaw-shield was returning HTTP 500 on every call. Its activate_system_policies() ran UPDATE "Policy" … WHERE slug = $2, but the Policy table has no slug column (only Organization.slug exists) → Postgres undefined_column (42703). So init could never complete the setup step.

Fixed in palveron/gateway#19: remove the dead, schema-invalid slug activation; return a truthful policies_active count (stable on idempotent re-runs). Rust gates all green (fmt/check/clippy -D warnings/test: 540 passed).

This PR's latest commit (a5255b9) coordinates: init now reads policies_active, with a fallback to the legacy sum so rollout order is flexible.

Rollout: merge gateway#19 (or confirm it's deployed) before relying on the live init/smoke; the client falls back gracefully if the gateway isn't updated yet.

[disruptivetrends]

Follow-up hardening (F1–F5)

Pre-publish hardening pass (commit b53da94). Every behavior below has a test; node --test → 22 passing (+9).

• F1 (Security) — governance_check with a missing tool_name/input no longer returns a silent ALLOW; it returns decision: ERROR (missing_required_field). That was the one reachable governance bypass; without tool_name the risk level isn't even knowable. (test: stdio MCP server → ERROR for both missing-field cases.)
• F4 (Correctness) — removed the dead LOW-risk skip branch in mcp-server.mjs; every check goes through verify (evaluated and traced — a local skip would ALLOW without a gateway call, making the action invisible in the dashboard). Removed the now-trivial shouldVerify export; classifyRisk docs made truthful (no LOW tier). SKILL.md + README + docs risk model aligned. (tests: classifyRisk never LOW; shouldVerify undefined; a "low-risk" tool provably hits /verify.)
• F5 (Hardening) — an unrecognized gateway verdict is no longer silently mapped to ALLOW. verify tiers it: HIGH → BLOCK (unknown_decision_failclosed, _anomaly), else ALLOW + _anomaly + console.warn. (test: injected SDK returning 'WAT' → BLOCK on exec, ALLOW+anomaly on read_file.)
• F2 (User value) — updateOpenClawConfig now finds ~/.openclaw/openclaw.json (the real OpenClaw global default) first, so the zero-config wiring actually fires. Extracted to src/openclaw-config.mjs with injectable home/cwd; preserves existing mcpServers. (test: temp home dir; foreign entry preserved; correct -p invocation.)
• Quick wins — bin header comment no longer says "8 rules"; cmdTest no longer defaults a missing decision to ALLOW (shows ERROR).

⚠️ Decision for @arndt (F4 — please confirm, can overrule)

The documented LOW "trace only, no check" tier was never implemented (classifyRisk never returned LOW; the skip branch was dead code). I aligned the docs to the code: everything ≥ MEDIUM is verified + traced, no skip tier; removed the dead code. The cheap low-risk trace-only ingest optimization (visibility without a full verify) is noted as Phase 1.5, not built now.
Alternative (if you prefer): instruct the agent to literally check everything — stronger visibility promise, higher quota usage. Default is the alignment above.